Ettercap/ettercap — pull request #372 by kholia (2013-10-24 11:02:53+00:00)
Title: add support for parsing OSPFv2 MD5 authentication packets

Sample .pcap file(s) can be download from https://github.com/kholia/my-pcaps URL.

```
$ ./src/ettercap -Tqr ~/OSPFv2\ MD5\ authentication.pcap | sort | uniq
...
OSPF-224.0.0.5-0:$netmd5$0201002cac1001010000000000000002000001105267ff8fffffff00000a0201000000280000000000000000$445ecbb27272bd791a757a6c85856150
OSPF-224.0.0.5-0:$netmd5$0201002cac1001010000000000000002000001105267ff98ffffff00000a0201000000280000000000000000$d4c248b417b8cb1490e02c5e99eb0ad1
OSPF-224.0.0.5-0:$netmd5$0201002cac1001010000000000000002000001105267ffa2ffffff00000a0201000000280000000000000000$528d9bf98be8213482af7295307625bf
OSPF-224.0.0.5-0:$netmd5$0201002cac1001010000000000000002000001105267ffacffffff00000a0201000000280000000000000000$79033a8dcd5ab701e1c39a2989eaa123
```

Cracking the hashes with JtR (bleeding-jumbo).

```
$ ../run/john hashes
Loaded 4 password hashes with 4 different salts (net-md5, "Keyed MD5" RIPv2, OSPF, BGP, SNMPv2 [MD5 32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
abcdefghijklmnop (OSPF-224.0.0.5-0)
abcdefghijklmnop (OSPF-224.0.0.5-0)
abcdefghijklmnop (OSPF-224.0.0.5-0)
abcdefghijklmnop (OSPF-224.0.0.5-0)
```